diff --git a/.github/workflows/go-cli.yml b/.github/workflows/go-cli.yml
index a100a9b..a828139 100644
--- a/.github/workflows/go-cli.yml
+++ b/.github/workflows/go-cli.yml
@@ -74,6 +74,16 @@ jobs:
         with:
           go-version-file: go.mod
 
+      # golangci-lint's analysis of each package, which setup-go does not keep, keyed by content
+      # inside, so any older copy is safe to start from: saved under the commit, restored from the
+      # newest - main's for a pull request.
+      - name: Lint findings, from the last run
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: artifacts/golangci-lint
+          key: golangci-lint-${{ github.sha }}
+          restore-keys: golangci-lint-
+
       - run: go tool task lint
       - run: go tool task spec:compliance
       - run: go tool task vuln
diff --git a/go.mod b/go.mod
index 9c62f9c..b2136a2 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module github.com/devcontainers/cli
 
 go 1.27.0
 
-toolchain go1.27.3
+toolchain go1.27.4
 
 require (
 	github.com/Masterminds/semver/v3 v3.5.0